Gone Phishin'

Talk about ironic timing! Just hours before helping run a webinar on data security, I got "spear phished" for the first time.

Like everyone, I've been "phished" before. That's when you get those annoying spam emails posing as, say, your bank or another trusted entity. They're generic mass emails that are sent to tons of people at once in the hopes that a few recipients will be fooled into sharing sensitive information like bank or credit card numbers.

Fortunately, they're pretty easy to spot--just hover over any link (don't click!) to see if the address points to the actual domain of the purported sender or to something suspicious like xxx.sh.123.2.ch (or something). Broken English is a common red flag, too.

What is Spear Phishing?

Spear phishing, on the other hand, is a highly targeted version of phishing (hence the name). Here, spammers know your name, they know your email, and the know the name of those you're connected to--and that's how they get you.

When targeting me, they posed as RE Technology's CEO, Victor. Because our name, title, and contact info is listed on RE Technology's site--a necessity for doing our job, by the way--the spammers were able to intuit enough about us to know that it was likely I would trust a message appearing to be from Victor.